There were various articles announcing Vista sp1, including one on the official Vista team blog which managed to say lots about all the good stuff and conveniently forget some things like the removal of the very useful GPMC, which is only mentioned in the whitepaper (and later reported on by various bloggers and journalists of varying degrees of credibility).

I have to admit that reading whitepapers can sound pretty dull, particularly when they relate to something I can’t download yet. I tend to think “I’ll read it nearer the time, once I have actually downloaded <whatever> and can apply what I am reading”. On this basis it is easy for people to overlook this announcement amid the other marketing hype.

In my mind there are two key questions here:
Firstly, I know there is supposed to be a new enhanced version of GPMC available at some point, but will it be available in time for the Beta testers? Or even for the final release of sp1? This remains unanswered at the moment, and is crucial. If it is available, it lessens the impact considerably.

Secondly, why take a retrograde step to remove something which is already in there? This second question is the one which most other commentators have addressed.

Jeremy Moskowitz, MVP for Group Policy makes some valid points on a post entitled “Vista + SP1 = Gbye GPMC” in his blog (sorry but I can’t find a way to link to the specific post):

Today, the GPMC is part of Vista. That’s great. One less thing to load.
But what’s also (now) true is that if you install SP1 for Vista (not yet available) the GPMC will be uninstalled. Why?

Because this allows for something that I’ve personally advocated for. That is, when new goodies are ready to be launched in Group Policy land, let’s GET IT OUT THE DOOR. And it used to be this way. The GPMC was a simple download and simple install. When bugs were found in the GPMC, that meant it was a quick fix to jam the fixes in, and re-upload the file for the masses.

But now (today) the GPMC is part of the Longhorn and Vista operating systems. Is this good? Not really, in this one dude’s opinion. Because what if some new whiz bang feature is suddenly available? Then you’ll have to wait until MAYBE an operating system service pack, or at worst a full operating system revision until it’s updated.

Darren Mar-Elia (another GP MVP) wrote a very extensive post about the Vista sp1 release, specifically pointing out lots of errors in one of the many articles about sp1. In it he takes up the same idea as Jeremy:

Back when GPMC first shipped, out-of-band of the OS, I’m sure Microsoft heard complaints that it should be in the OS, since it became such a crucial part of managing GP for many shops. So, they went and did the most logical thing – they put it in the box in Vista.

But to do that resulted in GPMC having to become part of the behemoth that is the Operating System release cycle at MS. This has obvious limitations if you know how glacially things move within MS when it comes to OS revs. Once inside the OS, they could no longer rev the GPMC and make enhancements to it on their own schedule.

However, I can’t see that the GPMC is so tightly integrated to the operating system as to prevent an update independently of the service pack cycle. The GP processing engine, sure (although making that its own process in Vista outside of winlogon should help with any patches that are needed). But the GPMC is an application. It does nothing until invoked by the user. I realise that it can still use shared code, but does it, in fact?

Anyway, if the GPMC so woven into the fabric of the OS that it can’t be independently tested and upgraded, how are they managing to take it out so easily? Surely that is contradictory?

Other OS components installed by default have upgrades made available periodically, the most obvious being Internet Explorer and Media Player. MS have claimed for a long time that both of these are fundamental components of the OS and it would not be possible to ship Windows without them unless it was severely crippled. This has been the basis of its defence in previous anti-competitive practices (antitrust) lawsuits. Microsoft just spent three years appealing a decision by the EU courts that ruled they had to produce a version of Windows XP without Media Player (which they have subsequently done for both XP and Vista)

Darren goes on to say:

But, with GPMC installed on every desktop, any joe user with normal non-administrative rights in the domain can open GPMC and view the settings on any GPO they have read access to! Further, they can also backup all GPOs that they have read permissions on, to, say, their USB keys

Technically true, and echoed by others. However, this overlooks the fact that to run GPMC on Vista in a default configuration the user requires local admin rights on their domain account (the local admin account won’t be able to access the domain policies, only the local ones). So yes, if you have domain users with local admin rights on their machines, they could run GPMC as described and take a copy of your policies. I’ll ignore for a moment the lack of security inherent with that model (because I accept there may be users who have a second account for doing admin things occasionally via a runas or UAC).
My question is this: surely a user sophisticated and malicious enough to do what Darren suggests would also be able to take the trivial step of installing GPMC if it was not already on their machine?

If they don’t have local admin rights they could still take a copy of the files for the policies they have read access to by going directly into the sysvol share. This would then take more effort to interpret than a GPMC report but they could easily restore them into another domain (in a virtual machine, say) in the same way you would have done before GPMC.

As a counter to this, surely we should be advising people to take more care in the creation of their Group Policies? It is very easy to ignore the security filtering for most purposes if you have designed your AD to enable you to target your policy links exactly where you need them. However, it may be prudent to remove “authenticated users” from the security filter (or via the delegation tab) and add back in only those groups who actually need to receive each policy.

You could start by having a security group for all computer accounts and another for users if you are following recommended practice of keeping the two types of settings separated and only enabling one ‘half’ of the policy. This would immediately secure your computer policies against the sort of access that we are concerned with here, including via sysvol. More granular groups would be ideal, but would increase the overhead of managing things.

So, I remain to be convinced that having GPMC pre-installed actually makes anything less secure than it already is. I am also unconvinced that it needs to be removed in order for independent updates to take place, as that would imply it was very tightly integrated in the OS, which would imply it could be quite hard to take out of the codebase, which seems to me a little contradictory.

I’ll just have to live without it, or install the enhanced version as long as it is available soon enough. It just still seems illogical.

Share this post :

David Overton posted an article about what’s coming in the first service pack for Vista. In it he links to and quotes this BetaNews article which says:

the service pack will uninstall the Group Policy Management Console (GPMC) and GPEdit.msc will edit local Group Policy by default

So where did they get this important bit of information? It’s not in the Vista Team blog announcement, nor the extensive interview with Jon DeVaan, senior vice president of the Windows Core Operating System division at Microsoft.

It is in fact buried in the middle of the White Paper about the Vista sp1 Beta release, a document you may not have bothered to read in detail unless you are one of the lucky(?) 10,000 who will get to test this out. The relevant paragraph, in full, reads:

In addition to these changes, Windows Vista SP1 will change the tools that customers use to manage Group Policy. Administrators requested features in Group Policy that simplify policy management. To do this, the service pack will uninstall the Group Policy Management Console (GPMC) and GPEdit.msc will edit local Group Policy by default. In the SP1 timeframe, administrators can download an out-of-band release that will give them the ability to add comments to Group Policy Objects (GPOs) or individual settings and search for specific settings.

Now, I’m a bit of a zealot for good systems management (one of the original drivers for me writing this blog, and the idea for the name). I would also say I am an evangelist for Group Policy – particularly as one of the site admins for GPAnswers.com where there is a thriving community helping out people in difficulty over the intricacies of the subject.

I have heard lots of people say that adding GPMC into Vista “out of the box” was a good thing, and a few grumbling that there is no new version for XP/2003 yet, nor a downloadable version in case you break the built-in one (although that should be repairable in any case.

However, I have yet to hear of anyone saying they wish it was not there, and that it is too complex or gives too much power to someone. If you are one of these people, please let me know why you feel this way by leaving a comment. I hope to convince you of your error (told you I was an evangelist!)

The possible saving graces for me are these improved features which are discussed in the same white paper:

• BitLocker Drive Encryption encrypts extra local volumes. For example, instead of encrypting only drive C, customers can also encrypt drive D, E, and so on.
• Administrators can control the volumes on which to run Disk Defragmenter.

Both of these will be useful to me. I hope they make it through the Beta to the released version.

Spread the word :